Build a Grafana Geomap of Traffic and Threat Score

A Grafana Geomap showing traffic by country and coloured by threat score takes about an hour to build. Almost none of that hour is the map. The map is a built-in panel and it does what you'd expect. The work is upstream: getting a country code and a risk score onto every log line, cheaply enough that you're not paying per request for the privilege. And if you search for this, you'll find a pile of tutorials that solve it with a panel that stopped loading in May 2025. TL;DR Use the Geomap panel. The Worldmap plugin is AngularJS, and Angular support was removed outright in Grafana 12. Enrich the log line at the edge with an Nginx module reading local MMDB files, or batch-enrich unique IPs through an API and cache the result. Both work. They fail at different scales. Ship with Alloy, not Promtail. Promtail was removed from Loki in 3.7.3. Colour the map by max threat score, size markers by request count. Don't average them. The gotchas that will eat your afternoon: latitude and longitu